[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5i0xltlFZuXLBHjgLpYkXNYA5ExC4Ss1ZZUTBvU6Nsw":3},{"article":4,"iocs":48,"watch_terms":52,"solutions":53,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"e2345040-ac6f-4f28-81b0-5cbb83ec2c46","LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release","litellm-suspects-github-token-leak-in-ai-gateway-logs-behind-malicious-package-r-89c43e","LiteLLM on Wednesday disclosed that threat actors compromised \"multiple independent security controls\" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m.","LiteLLM disclosed a supply chain attack on October 21, 2026, where threat actors compromised multiple security controls to release a malicious version (1.107.0) of the Python package to PyPI and Docker Hub. The package contained a credential stealer and backdoor. LiteLLM suspects the compromise stemmed from a leaked GitHub token exposed in AI gateway logs.","LiteLLM Python package compromised with credential stealer and backdoor via suspected GitHub token leak.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Flitellm-suspects-github-token-leak-in.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgiEKKMESHBCMBHXA8Yf_clmAeFQXSdaKTEz0t_6RDzj1zXcwiPxA4gy2MPmftM6vyCkoG7OsCZJ2a8t7xJe1qbn3tEWRZfVgStzQVJy0ZfwEkjhg6-A34iT3XnQG7nYku04cWbIaHwkQmuDVghCeJBx5xJcbtozsyD3Genw4wyxFtgWIVD-rRGRLMBKoq2\u002Fs1600\u002Flitellm-breach.jpg","2026-10-22T08:28:48+00:00","2026-10-22T12:00:03.100679+00:00",9,[17,20,23,25],{"name":18,"type":19},"LiteLLM","product",{"name":21,"type":22},"Python Package Index (PyPI)","technology",{"name":24,"type":22},"Docker Hub",{"name":26,"type":22},"GitHub","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":27,"icon":29,"name":30,"slug":31},null,"Supply Chain","supply-chain",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":37,"value":50,"context":51},"LiteLLM 1.107.0","Malicious Python package version containing credential stealer and backdoor released to PyPI and Docker Hub on October 21, 2026",[18],{"controls":54,"vendors":132},[55,83,112],{"slug":56,"name":57,"problem":58,"products":59},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[60,67,75],{"vendor_slug":61,"vendor_name":26,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":84,"name":85,"problem":86,"products":87},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"cribl","Cribl","\u002Fvendor-logos\u002Fcribl.png","cribl-stream","Cribl Stream","https:\u002F\u002Fcribl.io\u002Fproducts\u002Fstream\u002F","Collects, reduces, redacts and routes data between sources and tools, keeps a full-fidelity copy in low-cost storage, and replays it when needed.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-transit","GreyMatter Transit","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Ftransit\u002F","Security data pipeline that normalises and routes telemetry and detects threats while the data is in motion, to cut lag and storage costs.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-pipelines","Abstract Pipelines","https:\u002F\u002Fwww.abstract.security\u002Fplatform\u002Fcollection","Collects security data from any source, normalises it in the pipeline and routes it to several destinations.",{"slug":113,"name":114,"problem":115,"products":116},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[117,118,126],{"vendor_slug":61,"vendor_name":26,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":127,"product_name":128,"url":130,"description":131},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[],{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":145},"leaked-github-token-in-ai-gateway-logs-enables-malicious-pypi-package-release","Leaked GitHub Token in AI Gateway Logs Enables Malicious PyPI Package Release","LiteLLM's supply chain attack illustrates how sensitive credentials inadvertently logged in AI gateway outputs can cascade into a full package compromise. A GitHub token exposed in logs gave threat actors the access needed to publish a malicious version of the LiteLLM Python package containing a credential stealer and backdoor to both PyPI and Docker Hub. This matters because downstream users and automated pipelines that trusted the official package source were silently exposed to credential theft and remote access without any visible warning. The incident highlights that AI systems processing or logging API calls can themselves become a novel attack surface for secrets exposure.",[138,139,140,141,142,143,144],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":146,"MITRE ATT&CK T1566: Phishing":147,"NIST SP 800-53 SI-2: Flaw Remediation":148,"OWASP A06:2021 Vulnerable and Outdated Components":149,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":150,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":151,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":152},"NIS2 requires entities to implement incident handling and supply chain security measures; the malicious package release through a compromised publishing pipeline is precisely the supply chain risk scenario NIS2 mandates organizations to address with technical and organisational controls.","While token leakage via logs was the root vector, the resulting supply chain compromise mirrors ATT&CK's credential access and initial access techniques, underscoring the need to treat exposed tokens with the same urgency as phished credentials.","Consumers of the LiteLLM package needed a timely, verified remediation path once the malicious version was identified; SI-2 mandates processes to identify, report, and correct flaws in information system components including third-party software.","Organizations that automatically consumed LiteLLM 1.107.0 without verifying integrity or provenance were exposed to the backdoor; OWASP A06 specifically calls for verifying components only from trusted sources with integrity checks.","Monitoring for unauthorized or malicious updates in third-party packages is a technical vulnerability management obligation; this control would require processes to detect and respond to the tampered package before widespread deployment.","AI gateway logging configurations should have been set to scrub or never capture sensitive tokens; a secure baseline configuration would have prevented credentials from appearing in logs in the first place.","Scoped, short-lived, MFA-protected tokens for GitHub and PyPI publishing would have limited the blast radius of the leaked credential, as the framework requires strict access control over privileged identities."]